Sign in to servers with SSH keys

An SSH key is a pair: a private key that stays with you, and a public key you put on each server. It's safer than a password, and you don't have to type anything to sign in.

Get a key

On the Connections page, open Keys & passwords.

• Import file… or Paste key… adds a key you already have. OpenSSH, PEM and .ppk files work, with RSA, ECDSA or Ed25519 keys. DSA keys aren't accepted.
• To make a new key, sign in on the website, open Hosts, then SSH keys, click Add key and choose Generate a new key. Ed25519, RSA and ECDSA keys are available.

If a key has a passphrase, you type it once to unlock it, then choose Remember or Ask each time.

When you import saved sessions and hosts from other apps, the key files those sessions use can come in at the same time.

Put the public key on the server

1. In Keys & passwords, click Copy public key for your key.
2. On the server, add it as a new line to the file ~/.ssh/authorized_keys in the home folder of the user you sign in as.
3. Make sure that file and the ~/.ssh folder belong to that user, and that only they can change them.

On a Linux server you can do step 2 from a terminal you're already signed in to:

mkdir -p ~/.ssh && chmod 700 ~/.ssh
nano ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

Pick the key for a server

Edit the host on the Connections page and choose key sign-in with your key. On the Hosts tab, editing is in the host's … menu; see hosts and sessions. When you import cloud servers from AWS, DigitalOcean or Azure, you can pick one key for all the Linux servers at once.

To use the key from a browser too (the website's terminal), save the host to your vault: with Upload saved SSH passwords to my account on in Settings (Pro), a host with Save this host's password/key to my vault ticked takes its key into your vault, end-to-end encrypted. Keys no host uses can go up on their own with Also use this key on the website (end-to-end encrypted). The Linux app can't upload keys yet: add the key on the website instead (Hosts → SSH keys).

"Didn't accept the key"

If a server says it didn't accept the key for your user (often shown as "Permission denied (publickey)"):

• Check the public key is in ~/.ssh/authorized_keys for the same user name you connect as.
• Check the file and folder permissions above. Many servers ignore keys in a folder others can change.
• Check the host uses the key you think it does. If a host says no key is chosen for it on this PC, edit the host and pick one.
• Some servers only allow certain key types. Ed25519 works almost everywhere.
• If the server refuses the connection or times out before it gets to your key, see can't connect to a server.

Your private key never leaves this PC unless you choose to use it on the website, and then it's end-to-end encrypted.